search

MicrosoftEdge / static-code-scan

Run this quick static code scan on any URL to check for out-of-date libraries, layout issues and accessibility.
Other
1.05k stars 227 forks source link

Whitelist certain files for specific features #21

Closed dmethvin closed 10 years ago

dmethvin commented 10 years ago

Some third party scripts like analytics do browser sniffing, but only for the purpose of sending the browser name/type back for analysis. Since those kind of uses aren't evil and the includer of the file has no control over it anyway, it could be useful to exclude the file from the report via a URL match of some kind (domain or file name). Examples include Google Analytics as well as the ones listed below.

Via this email feedback:

Mon 10/7/2013 10:28 AM To: IE Dev Relations;

Hi... just some feedback on your lovely tool. :)

The test for Browser detection should exclude analytics programs (like MixPanel and Kissmetrics). Those are measuring things — but are not affecting the page. We serve the same thing to everyone. (But your tool says I'm browser sniffing.)

molant commented 10 years ago

In previous versions the scanner only analyzed the JS files that were in the same domain. If they were in another (or even a subdomain) the JS were ignored. This could be a bug introduced in the new version. Do we want to go back to the previous model and thus not analyze all the files or do we want to have a whitelist of approved domains for this?

dmethvin commented 10 years ago

Hmmm, okay, then it probably needs to be investigated further. The only way this should have happened is if the person was using local copies of the scripts, and I don't know if they were.